Syntax
UPPERCASE words are placeholders to replace. Brackets in the syntax line describe optional arguments; do not type those brackets literally.
netstat [-a] [-n] [-o] [-p PROTOCOL]Example
netstat -ano -p tcp
# For a PID just observed, replace 1234:
tasklist /fi "PID eq 1234"Expected result
Numeric TCP endpoints and states with owning PIDs. tasklist identifies a process when that PID still exists and is visible.
Notes and traps
Windows netstat.exe syntax differs from similarly named Unix utilities. LISTENING and ESTABLISHED answer different questions. -b requests executable information and may need elevation; it is deliberately omitted from the basic example. A process may exit or its PID may be reused between commands.
Try it
Locate one LISTENING row and one ESTABLISHED row if present. Explain why a loopback listener does not demonstrate that another laptop can reach the service.
Answer and reasoning
LISTENING is a local socket awaiting connections. ESTABLISHED is an existing connection. Loopback belongs to this host, so remote reachability requires another appropriate bind address plus networking and access policy. Absence of an established row may simply mean no current client.
Related commands
Related tasks may need different flags and have different semantics. Check the entry before translating a command between shells.
Official reference ↗Updated 14 September 2026. Microsoft reference reviewed 14 September 2026; CMD/Windows execution unavailable.